The other half of the /trial/register security fix. A repeat signup request for an email that already has a key no longer returns that key -- it emails a one-time link here instead. This endpoint is what actually reveals the key, and only once: the token is single-use and expires in 30 minutes (both enforced in consume_verification_token, in SQL, not here).

An unrecognised token and an expired token deliberately produce the identical response -- never confirm which case it was.